docker.service 修改指南
vi /lib/systemd/system/docker.service
docker.service默认内容如下：
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
BindsTo=containerd.service
After=network-online.target firewalld.service containerd.service
Wants=network-online.target
Requires=docker.socket
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always
# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
# Both the old, and new location are accepted by systemd 229 and up, so using the old location
# to make them work for either version of systemd.
StartLimitBurst=3
# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
# this option work for either version of systemd.
StartLimitInterval=60s
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
# Comment TasksMax if your systemd version does not support it.
# Only systemd 226 and above support this option.
TasksMax=infinity
# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes
# kill only the docker process, not all processes in the cgroup
KillMode=process
[Install]
WantedBy=multi-user.target
下面的配置都是在[Service]节点下的ExecStart属性后面加参数值，docker.service文件被修改后请执行systemctl daemon-reload && systemctl restart docker，如果配置未生效，请执行systemctl status docker查看服务状态。
开启远程API访问端口
添加-H 0.0.0.0:2375，端口可以随意指定，修改后的ExecStart如下：
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H 0.0.0.0:2375
重新加载配置并重启docker
systemctl daemon-reload && systemctl restart docker
访问http://127.0.0.1:2375/info进行验证
修改bridge网络的ip段
执行docker network inspect bridge命令可以发现bridge网络默认的IP段是172.17.0.0/16，添加--bip 10.0.0.1/16修改默认IP段
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --bip 10.0.0.1/16
重新加载配置并重启docker
systemctl daemon-reload && systemctl restart docker
启动一个nginx容器进行验证
docker run -dP --name nginx nginx
docker inspect --format '{{ .NetworkSettings.IPAddress }}' nginx
docker rm -f nginx
配置私有镜像仓库
以下示例配置develop-harbor.geostar.com.cn，test-harbor.geostar.com.cn，release-harbor.geostar.com.cn三个私有镜像仓库
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock \
--insecure-registry develop-harbor.geostar.com.cn \
--insecure-registry test-harbor.geostar.com.cn \
--insecure-registry release-harbor.geostar.com.cn \
重新加载配置并重启docker
systemctl daemon-reload && systemctl restart docker
手动拉取私有镜像仓库中的镜像验证
配置dns
以下示例配置114.114.114.114 和8.8.8.8两个dns服务器地址
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock \
--dns 114.114.114.114 \
--dns 8.8.8.8
重新加载配置并重启docker
systemctl daemon-reload && systemctl restart docker
启动一个alpine容器镜像验证resolv.conf配置文件是否成功修改
docker run --rm alpine cat /etc/resolv.conf